A new feature to fix DRUPAL-PSA-2016-003 security issue.

Notify on site status report page if insecure webforms are found. Webforms should be considered insecure if anonymous users are allowed to submit files using public scheme.

CommentFileSizeAuthor
#7 warn_admin_users_on-2816405-7.patch3.96 KBvinmassaro
#5 webform-security_report-2816405-5.patch1.65 KBilari.stenroth
#2 webform-security_report-2816405-2.patch1.49 KBilari.stenroth

Comments

ilari.stenroth created an issue. See original summary.

ilari.stenroth’s picture

ilari.stenroth commented
Status: Active » Needs review
StatusFileSize
new webform-security_report-2816405-2.patch1.49 KB

Here's a patch to implement the feature.

ilari.stenroth’s picture

ilari.stenroth commented
Parent issue: » #2816121: [meta] Is there anything webform can do to mitigate PSA-2016-003?
ilari.stenroth’s picture

ilari.stenroth commented
Title: Warn admin users on site status report page if insecure webfors are found » Warn admin users on site status report page if insecure webforms are found
ilari.stenroth’s picture

ilari.stenroth commented
StatusFileSize
new webform-security_report-2816405-5.patch1.65 KB

New revision of the patch. Now counts correctly insecure webforms.

vinmassaro’s picture

vinmassaro commented

@ilari.stenroth: thanks for this patch - I'm modifying it slightly to add links to the problem webforms. New patch coming shortly.

vinmassaro’s picture

vinmassaro commented
StatusFileSize
new warn_admin_users_on-2816405-7.patch3.96 KB

Here is a new patch that combines my additions with the patch from #5. It adds a list of problem webforms with links to each so they can be more easily edited. This is very helpful for a site with a lot of webforms.

danchadwick’s picture

danchadwick commented
Status: Needs review » Needs work

Difficulties with this approach:
1) There may well be authenticated-but-untrusted users.
2) Webform API functions alter submission creation and edit access, making it difficult or impossible to know if a particular user can upload a file and is also untrusted.
3) Some sites have a huge number of webforms, which will cause this to time-out.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Status: Needs work » Closed (outdated)

Drupal 7 is no longer supported. If this applies to a supported version, please re-open.

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.